���M%�#�����I����e�S��Q�۰mG�Y���{��e>�5Z�?H����N}-� ���:��M�E�3��rVY���=����������%� �p;� �k�< "$����TJj��}��[i7IX�8�H���q�O���Y� g ��O�@F>���%t���m�Nyb�������z�V�:ן˰��yct�2˯p�~���:ev��u^�]V4�1��/�zV�������lK:۰�J�Rpa�Q}�P,��OU�Z��6pď�����Y��~�r,54����#:i���l83W��;D�����,7��Af�nǻ������s����qז��Ϙ�j�2�����v*�ˬ�[�XI��� �S`w},��L�j�U��>-^?�P�Ņ}���JUe����2L7����R���ƒ�!g�C6L��(����ƝS�sv��_xy����E:��*գ���X���f\^!�ĖH��V��sY���t�;���e�?SU;�Q3r�k���X���������g�O�y�R[�[4l9X@V��^߭��~�_J ����p�E����Y�ܯB�f��8�вS���]�,Vn0��#X��NF>r��/��P�,�\;, �_��hnsO���pL����a��eQ�����e��q�O�<�B�e��N +���j��#V�2��Υ�c7`C{�;)�dBTtm~��1����2ffK�/N��8�ox�:����F���ͽb�����/3��)��ϭ0E����+�Q/��U�� �OM��4 p�$"�o ����./�� ����0��Q ��%@�*(�����9E�@��ML�/[��z��UTdA#K� 2>P�����1�����Ţ�����=��d�)j��n�_ZX�~o`^#�O8"��#u>^�G�Lq��ꌳ���&D��x�k��s���Z���^@c�j}ɡ�� �<I��>������yM���V�稝��H�����Xх��-<PCL�{X��K������)��0`.�c@-L ������<��8�s������q >.������p�EP��[\��&dg��'L+Y�q�]X�Sh`�������ײ냢��J�m��9m&�����#h� �G�(Se}Y���oY]Z���j���KwʇQ{�3�yk>r��P��E$d���'E�\�p�h�i�7���Zl��=���c��X^��l���d�kG�F��2ڍ^pu����Ҵ�u<�q��������J�������2n`d���`�!!Z�P�Y+e$��jtEk�\���������3�Jv� k�Ņ�q���a`� ;.e�ϒ =wR��G������d-l��?Z8�ߥN���KgF},Ng.�LI?}C�#���oaK�L|���*����MS�B���������H�����6�]C��:��Q?cr�uK�k����q;Pڷ��Ɨ�;a2%��{�l���P�q�� �#L��+��HEu+ʐ[X����k⾧�����-��A�2�Ɯ �N��y'k<�\�K^˻�[o�ς��Hl��UN������ }�&�}!GC�q(�~$�E�i����p�Bu�xY[��P{�q�"r�E����.���!��C)e �s�?b�%��*�VJ鐹�h������~$HY��,Q7c�ՐD�et�� Z6�e��_�ե^�ܗ$ֿ��@I�+�Qx% 32x�N@/$Se�$ �s�]U�#ʂ�'i����U��1k�u}�~i���@V I}@�%T�-!����:���8TL�����k�O-�m�Q����%6km�R;��5 ��[%N�*[�:8�ӠZ��T�j�p���+cy�t�_�D~�Ҹ�N�&x=���n�n9�RpɈ(���������K����Fdq��WF�5����-��c�W����\[7�E���M��6%*�цx�+���B�����b��������߳Y�3S�ˠ�_���b�F��5�P���J˖T���s���1�7��weA�3���:B�Z���/�l�@�k&�X�֭�9�F1G��횔y�h�e`�*�]�`�+FY)�0qaO� t��J0�#�|��q��8A'������ �Q7 ��s��Wq�MԍK� �k�ɪ�����>�0�qV��5پ��:�����{������r�Nc��'�BU�Y�[G)�P"賲�;M�θ�����*~jb�N�)���6��E`���Vk����N��;��� �z�[�Ǭ�u���%(�Cc�P�8�?0^6�'��d�?S�<�s�>������g6�qG�$Lw�@���� 20xq�����҉�5���ѥ���f�5�&�(��ފ Æ{��p����*@�5�þ���"�Huj�hv-��鶻Y�� �F�W[� �M�pR���ac`��T�Z�p�q֟��d���Fc����U�a�cawb�o�\_<��j���i�˘��|0��B8��e�ԥ�ۅ��b�S.�HT�pDKX� X��S�Ys����dX�"i�Yp�����5�:/?}��oיQڣ��:�k���z�?�A�O�yRx� ;x�W�4B#Qȹ�� E��&���n�鴲���X������~:33:��$�IV�J�D�_Tzh��!��iǧt'�mL�����F��U:����� ��Oi �Y�i��:ޭ�k�(��f��ϳq��V���v�r�u�0�7���&�ga�z���Aj��(M�� '�9�� & ��f,�0_䴩����a��YWEҽ\��e�i�1�_��Bz��\�/�gY�t��fv+U�LO[@� �~]������1|�B��IYn`� ��=XC[x� J�qbNH`e��'��o���ੜ: 8D(�a� Ns�3D�]��1]5Ϳ�B�k}�H�=ȕ��Bʻ%��mb���<��T$�R6�$� ��l���/��+���S2�x\��&I�iA�W��Ӣ�KU���ߔ�̦�k�Y��w�1��hQ��'1L�,��#w����sP��� ,k�D�R�g~�7���K�04R��#m�l��2Ῠ�����"*e��`�}�B�&N�AMB���s�>�#U��`/��Ie� ag��
Behavioral task
behavioral1
Sample
1a7d60d56720ff03a79cf798c2811f038daa8fd19881c8c3bcd75daf89351d45.exe
Resource
win7-20231215-en
General
-
Target
1a7d60d56720ff03a79cf798c2811f038daa8fd19881c8c3bcd75daf89351d45
-
Size
8.7MB
-
MD5
a4b8b44432876a1391a3ae3b74ba7e8a
-
SHA1
00b5a5dd2c8fa7dfb17977a8d5dd7912d901471a
-
SHA256
1a7d60d56720ff03a79cf798c2811f038daa8fd19881c8c3bcd75daf89351d45
-
SHA512
7f98b6b685da07935d18787a3321090788be33f98011efdc885bc56da4dec655adf990296d5ca12edb3f9efe52c0ba803e0d1a636c0793b95d387f50717894cf
-
SSDEEP
196608:FO+8WdOkBv9Piink83SZUsYR0AxyukPvGaOtpXahcI17Wxb46CHQNM3XBhQWkeqK:FdSw1izeXLxYORQcIrCmX/mxm
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a7d60d56720ff03a79cf798c2811f038daa8fd19881c8c3bcd75daf89351d45
Files
-
1a7d60d56720ff03a79cf798c2811f038daa8fd19881c8c3bcd75daf89351d45.exe windows:5 windows x86 arch:x86
6e77744e303590ff0891ab87caac8d47
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutWrite
ws2_32
htons
rasapi32
RasGetConnectStatusA
kernel32
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetLastActivePopup
gdi32
ExtSelectClipRgn
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_DragShowNolock
wininet
HttpSendRequestA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 852KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.7MB - Virtual size: 8.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ